CVE-2022-36098: XWiki Mentions UI stored XSS via mention and macro fields

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 3.1 base score is 9.0 (critical) with high confidentiality, integrity, and availability impact, and EPSS is 0.71043 at the 99.37th percentile.

What it is

XWiki Platform Mentions UI allows JavaScript or Groovy scripts to be stored in a mention, macro anchor, or reference field. The stored code executes for anyone who visits the page containing the mention, making it a persistent cross-site scripting flaw. It affects versions from 12.5-rc-1 before 13.10.6 and 14.4, and is patched in 14.4 and 13.10.6.

Impact

An attacker with a low-privileged account can plant script that runs in the browser of every user viewing the affected page, enabling session theft, actions as the victim, or further compromise of the wiki. Because the scope is changed, the injected code can affect resources beyond the vulnerable component.

Attack surface

Reached over the network through wiki content that includes a mention, macro anchor, or reference field; the attacker needs a low-privileged authenticated account to store the payload, and a victim must visit the page for execution.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.71043 (99.37th percentile) and the advisory and Jira references are tagged Exploit, indicating public exploit information exists.

What to do

• Upgrade XWiki Platform to 14.4 or 13.10.6 or later.
• If immediate upgrade is not possible, apply the documented workaround by updating XWiki.Mentions.MentionsMacro and editing the Macro code field of the XWiki.WikiMacroClass XObject.
• Restrict who can create or edit wiki content containing mentions, macro anchors, and reference fields.
• Review and sanitize existing mentions and macro fields for stored script content.
• Monitor vendor advisories for further guidance on this issue.

Detection

• Search wiki content and page history for mention, macro anchor, or reference fields containing script tags or Groovy code.
• Alert on edits to XWiki.Mentions.MentionsMacro or the XWiki.WikiMacroClass XObject Macro code field.
• Monitor web logs and application logs for requests to pages with mentions that correlate with unexpected script execution or user session anomalies.
• Audit accounts with low privileges that create or modify mentions for suspicious payload patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.